More info.

Post #20,964 by Another Scott 12/10/01 11:06:01 PM Reply	More info. Note the last line of the script: urlgrey() The preceeding "code" defines urlgrey (assuming the initial part of the message was lost somewhere along the way). The last line runs it. [link\|http://www.cereus7.com/UGHome.html\|Urlgrey Tea] is a Basic-like language for applets. Probably not what this is... [link\|http://news.spamcop.net/pipermail/spamcop-list/2001-October/022988.html\|This] post to SpamCop.net discusses a similar obsfuscated script. Perhaps it's even from the same outfit. HTH. Cheers, Scott.
Post #21,038 by scoenye 12/11/01 3:54:05 PM Reply	Looks like it The bottom half builds windowopen("[link\|http://_135_blanks_@"\|http://_135_blanks_@"] + ???_1,"","width=800, height=600, menubar=???_2, resizable=0, scrollbars=1, status=0, titlebar=0, toolbar=0, left=100, top=100" + ???_3); which matches the discussion on SpamCop. The real URL is decoded by the top half, but the seed value is missing. Wondering if deobfuscating this was a violation of the DMCA? ;-)
Post #21,041 by drewk 12/11/01 4:00:09 PM Reply	That's what I figured But on this public terminal, even if I had some tools I could deobfuscate it with, I don't know enough about windows trojan programming to ensure I didn't trigger the damn thing just by trying to read it. Thanks for clearing it up (somewhat). I was wondering if I should report them to their ISP for it, but hell, no harm no foul, right? (Translates as: I don't feel like spending the next three weeks trying to explain to level 1 support that this thing was a nastygram.) We have to fight the terrorists as if there were no rules and preserve our open society as if there were no terrorists. -- [link\|http://www.nytimes.com/2001/04/05/opinion/BIO-FRIEDMAN.html\|Thomas Friedman]

Welcome to IWETHEY!